xy
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The agent is instructed to run a local bash script (
xy-sync.sh) to check for remote updates. This script is located in a sibling directory within the user's skill installation path. - [EXTERNAL_DOWNLOADS]: The
atoms-search.pyutility retrieves content fromhttps://api.xyskill.xyz/v1/atoms/search. This is used to query the vendor's cloud-hosted knowledge base for business advice and tactical information. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the external API and local feedback files, creating a potential surface for indirect prompt injection.
- Ingestion points: JSON responses from the search API and markdown files in the local
~/.xy/feedback/directory. - Boundary markers: The system does not currently utilize explicit markers to isolate these data streams from core instructions.
- Capability inventory: The environment supports shell script execution and file system access.
- Sanitization: The Python search script extracts and returns only specific data fields (id, confidence, knowledge) rather than executing returned content.
Audit Metadata